Trust
SECURITY
STATED PLAINLY.
This page lists what bluemint does, and only that. Each line points to the code that does it.
How bluemint handles your data
Meta requests are checked
Every event Meta sends to bluemint carries a signature. bluemint checks it against the app secret and rejects the request when it does not match. With no secret configured, it accepts nothing.
Orders and customers follow your sign-in
Orders and customers are looked up with the shop of the account that is signed in, not with a shop id sent by the request.
Customers can ask for deletion
Removing bluemint from Facebook sends a signed deletion request. bluemint verifies the signature, then clears the customer's name, phone number, delivery address and message text. The shop keeps its order records, without personal details.
Tokens and credentials are encrypted
Facebook Page tokens and courier credentials are encrypted before they are stored, using AES-256-GCM, and the key is kept outside the database.
Connected apps need your approval
An AI app connects only after the owner approves a page that names the shop, the app and each permission. The owner can remove a connected app later in Settings.
Sending and changing need a yes
From a connected AI app, sending a reply, publishing a post, booking a courier, changing an order's status or editing its items, charges or contact details, and deleting a customer each require explicit confirmation.
The Facebook permissions we ask for
Connecting a Page asks Facebook for these permissions. pages_show_list lists your Pages. pages_manage_metadata lets bluemint receive events from the Page. pages_read_engagement reads the product link on a Page post. pages_messaging sends and receives Messenger messages. pages_read_user_content and pages_manage_engagement read and moderate comments. pages_manage_posts publishes a Page post. email identifies your account at sign-in.
Read the full privacy policy, see how to delete your data, or contact support.